Certificate rotation is very essential for security of the cluster and the communication of its components. This page shows how to rotate certificates for cluster managed by RKE and Rancher.

NOTE: be aware that certificates of clusters that join Rancher but not created by it, are only managed by the tool that deployed the cluster.

RKE created clusters

• Rotate all services while using the same CA (certificate authority). It is important to have the cluster.yml that was used to create the cluster.

rke cert rotate --config cluster.yml

•  Rotate all services and CA.

rke cert rotate --rotate-ca --config cluster.yml

• Rotate specific service

rke cert rotate --service kubelet --config cluster.yml

Rancher created clusters

Select Rotate Certificates in the cluster Management window.

Options to rotate all services or individual ones